By Bhaskar Deep.

Let’s think like this, Storing our data at an unknown place. Is our data secure? can they access our business data? And the question chain continues…

Who is Using it?  

Modern technologies play a crucial role in the challenging IT world, many companies like Netflix and Adobe started using serverless applications. Many businesses are considering using serverless technologies and the growth of serverless applications has been vastly increased. According to Datadog, 80% of AWS container users adopted AWS lambda.

Why are They using it?

Serverless technology works on two services that explain the architecture. Firstly Back-end as a service where it operates the backend of the cloud which is mostly operated by a third party and functions as a service where code starts running using event triggers. 

The main reason that big industries started using serverless is because of the fast deployment of Products without a customer lock-in but from the developers’ aspect it’s easy to use and deploy, low cost, scalability, flexibility, efficiency, and most importantly better UX for best customer experience.

Security Threats 

For any type of technology, the main concern is data security. Traditional computing or serverless computing are facing cyber threats, to understand this let’s see the top threats of serverless architecture.

·      Function data event injection.

·      Broken authentication.

·      Insecure serverless deployment configuration.

·      Over-privileged function permissions and roles.

·      Inadequate function monitoring and logging.

·      Insecure third-party dependencies.

·      Insecure application secrets storage.

·      DDoS attacks.

·      Serverless function execution flow manipulation.

·      Improper exception handling and verbose error message.

Serverless applications are secure to use by continuous monitoring and most important usage of secure coding for your application. We can test a serverless environment by different patterns using a damn vulnerable application that is available in GitHub, which teaches us a secure way to launch our application in serverless 

Is it safe to use serverless?

We can never say that any application is safe, we can make it safe by following security policies. Yes, we can use serverless applications with the practice of secure coding and continuous monitoring of security risks that are already provided by cloud platforms. The main motto of going live with serverless is #Secure coding.

By Anton Scott.

Major operating systems such as Windows, Mac and Linux have never been as secure as some may believe them to be. As with any system, the main point of vulnerability is often the user; opening the wrong link/attachment, vising the wrong site, and installing suspicious software can open the floodgates for malware. These are all examples that a non-aware user can fall prey to, and in a world of growing cyber-threats, individuals & companies alike must take more precautions to avoid being targeted and taken advantage of.

Virtualisation is becoming a standard for many corporations as it provides an extra, solidified layer of defence in the event of a breach. Whilst most files or programs you open will run on your “Host” machine, virtualisation provides an isolated bubble for your OS to run in, by dedicating sectors of your hardware to create a virtual machine (VM).

Containment

This is a highly effective method of elevating your device’s security as any rogue programs running on the system will be limited to and only to the virtualised environment. Take this analogy for example. When a virus invades your body, your immune system triggers a response for white blood cells to encapsulate and isolate the foreign entity in order to prevent the spread and further damage the virus could cause to your body. This is exactly the case in the event of a virus, worm or type of malware infecting your computer system; The threat is contained within the VM and can therefore not spread or damage your host machine, which may contain your important files & personal data.

Resilience

VM’s also provide a convenient feature called “snapshotting”, where the state of the system can essentially be saved at any chosen time (known as taking a snapshot), then restored to a previous snapshot when required. This is specifically useful following a mishap such as a system failure or type of breach, as the machine can be reverted to its last known working state. Your presets & files will remain intact and your future self will thank you for it.

Privacy

Furthermore, if you are concerned with the growing issue of your online data being collected and sold by devious conglomerates (a sad but inevitable truth), you may be able to put your mind at ease by utilising a VM. “Fingerprinting” or “profiling” is a common way in which services online tie your devices and data to your identity and is used to predict your online habits, log your preferences and recommend you products/services. An entire online profile is built uniquely for you, hence the name “fingerprinting”.  Although quite impossible to avoid once you already have an online presence, operating systems like ’Whonix’ can run in a VM to promote anonymity online by relaying your network traffic through anonymous networks such as Tor.

Such setups require time to configure but can be useful if you’re serious about masking your identity online & giving a middle finger to the prying data harvesters. Ultimately, VMs are very practical systems which can offer the everyday user an elevated level of security which in turn can promote ease of mind. They are not compulsory by any means, but the growing use of them is a step in the right direction to limiting the damage caused by cyber-threats. And of course, it always helps to remember – if you protect your system, you protect yourself.

By Diana Ion.

Too many times overlooked by common security measures, side channels can offer attackers new avenues for information gathering and possibly much more. 

A simple definition of a side-channel is something that enables you to find out something about a thing without directly observing that thing.   

Think of a quiet neighborhood during wintertime.  All roofs are covered by snow, except for one. Naturally, you would think about something shady going on there and you could be right. Meth labs release a lot of heat and the effect of this on the snowy roof gives you information about what is possibly happening inside without you needing to actually look. This is an example of a thermal channel. 

Another example that should be familiar to you from one of the spy movies you have watched, is the classic trick of using a stethoscope to listen to a safe’s mechanism while rotating the dial with the obvious aim of opening the safe. The side channel in this case is the sound. 

Up to this point, it should be clear that a side-channel constitutes a consequence of a particular action. Now it comes the most interesting part.  Cryptographic implementations are based on computations at the bit/byte level. While performing these computations, computers are using electric power. If you are observing the power trace from a chip running AES or DES on an oscilloscope, you will see discernable patterns coming from the number of rounds, the memory access, or other algorithmic detail. This process is called simple power analysis and is a type of direct implementation attack.  

An implementation attack targets faults in the hardware/software implementation of an algorithm and not in the design of the algorithm per se.  

A more advanced attack that can also be used to find the key used in AES encryption is differential power analysis. Here, the attacker needs access to the device for collecting power traces during normal AES encryptions. With an available set of measurements, the attacker creates a model of the side-channel, inputs a hypothetical key, takes the given output, and performs a statistical analysis between his output and the real output. Perseverance and patience must be employed.  

I am curious sometimes and, during one lazy quarantine day, I decided to give it a try myself and break AES encryption with power analysis. I found a dataset of measurements online and wrote a Python script. The key size was 128-bits, meaning 16 bytes. Probably you know that AES-128 consists of 10 rounds with each round, except the last one, performing some particular operations (SubBytes, ShiftRows, MixColumn, AddROundKey). If these are unfamiliar to you, please do a Google search for AES rounds. To make my life easier and prove that the key is breakable, I only attempted to break the first byte of the key, after the SubBytes operation.  This means running through all the possible key values for the first byte (0 through 255), encrypting the plaintext with each one and compare the end results.

I will not go further into detail as I do not want you to get bored. My point here is that faulty implementations can leak sensitive.  Do not underestimate the ingenuity of attackers when talking about methods for speeding up computations. There are profile attacks and deep learning techniques that need only a small number of measurements to break the encryption. Common methods of combating side-channel attacks are usually divided into ‘hiding’ and ‘masking’.  These can be done at any level: transistor level, program level, algorithmic level, or protocol level. We will explore these in a future article. 

How do u know that you are your mother’s child?

How can you be sure that the chef in that restaurant did not spit in your lasagne after you complained that the service was too slow?